DoS & DDoS: Denial-of-service attack

• A denial-of-service (DoS) attack is a security threat that occurs when an attacker makes it impossible for legitimate users to access computer systems, networks, services or other information technology (IT) resources. 
• Attackers in these types of attacks typically flood web servers, systems or networks with traffic that overwhelms the victim's resources and makes it difficult or impossible for anyone else to access them.
• Restarting a system will usually fix an attack that crashes a server, but flooding attacks are more difficult to recover from. Recovering from a distributed DoS (DDoS) attack in which attack traffic comes from a large number of sources is even more difficult.
• DoS and DDoS attacks often take advantage of vulnerabilities in networking protocols and how they handle network traffic. 
• For example, an attacker might overwhelm the service by transmitting many packets to a vulnerable network service from different Internet Protocol (IP) addresses.

Batch Programming

 Batch Programming

• Batch file programming is a way of making a computer do things simply by creating a batch file.

• Batch programming is a programming paradigm that can execute certain commands automatically at the level of an operating system such as DOS or Windows 7 / XP. 

• A batch file is a stack of such commands. If it is retrieved with the command line, the system will execute each task listed in succession. 

• Batch files are often used to control and configure operating systems, but can also be used for other operations such as server installations. 

• A batch file is a collection of instructions that are used to run multiple commands at a time. It is a bundle of packages that are written In a sequence so that the user does not have to put commands and instructions again and again. These files contain .bat extension. This means that you have to save the batch files by using the .bat extension at the end of the file name. These are DOS commands and also can run on command prompt.

Layered Architecture

By organizing code into layers, common low-level functionality can be reused throughout the application. This reuse is beneficial because it means less code needs to be written and because it can allow the application to standardize on a single implementation, following the don't repeat yourself (DRY) principle.

With a layered architecture, applications can enforce restrictions on which layers can communicate with other layers. This architecture helps to achieve encapsulation. When a layer is changed or replaced, only those layers that work with it should be impacted. By limiting which layers depend on which other layers, the impact of changes can be mitigated so that a single change doesn't impact the entire application.

ASP.NET Web API

 The term API stands for “Application Programming Interface”. ASP.NET Web API is a framework, provided by Microsoft, which makes it easy to build Web APIs, i.e. HTTP based services. The ASP.NET Web API is an ideal platform for building Restful services on top of the .NET Framework. These Web API services can be consumed by a variety of clients such as

1. Browsers
2. Mobile applications
3. Desktop applications
4. IOTs, etc.

The most important thing to keep in mind is that we can develop both Restful and Non-Restful Web Services using the ASP.NET Web API framework. But mostly this framework is used to create RESTful services. In short, this framework does not provide any specific architectural style for creating the services.

SQL Injection

•  SQL injection, also known as SQLI, is a common attack vector that uses malicious SQL code for backend database manipulation to access information that was not intended to be displayed.
• It generally allows an attacker to view data that they are not normally able to retrieve. This might include data belonging to other users, or any other data that the application itself can access. 
• In many cases, an attacker can modify or delete this data, causing persistent changes to the application's content or behaviour.

Impact of a successful SQL injection attack

A successful SQL injection attack can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputational damage and regulatory fines. In some cases, an attacker can obtain a persistent backdoor into an organization's systems, leading to a long-term compromise that can go unnoticed for an extended period.

SQL injection examples

There are a wide variety of SQL injection vulnerabilities, attacks, and techniques, which arise in different situations. Some common SQL injection examples include:

• Retrieving hidden data, where you can modify an SQL query to return additional results.

• Subverting application logic, where you can change a query to interfere with the application's logic.

• UNION attacks, where you can retrieve data from different database tables.

• Examining the database, where you can extract information about the version and structure of the database.

• Blind SQL injection, where the results of a query you control are not returned in the application's responses.

 

Detection of  SQL injection vulnerabilities

The majority of SQL injection vulnerabilities can be found quickly and reliably using Burp Suite's web vulnerability scanner.

SQL injection can be detected manually by using a systematic set of tests against every entry point in the application. This typically involves:

• Submitting the single quote character ' and looking for errors or other anomalies.

• Submitting some SQL-specific syntax that evaluates to the base (original) value of the entry point, and to a different value, and looking for systematic differences in the resulting application responses.

• Submitting Boolean conditions such as OR 1=1 and OR 1=2, and looking for differences in the application's responses.

• Submitting payloads designed to trigger time delays when executed within an SQL query, and looking for differences in the time taken to respond.

• Submitting OAST payloads designed to trigger an out-of-band network interaction when executed within an SQL query, and monitoring for any resulting interactions.

SQLI prevention and mitigation

There are several effective ways to prevent SQLI attacks from taking place, as well as protecting against them, should they occur.

• The first step is input validation (a.k.a. sanitization), which is the practice of writing code that can identify illegitimate user inputs.
• Most instances of SQL injection can be prevented by using parameterized queries (also known as prepared statements) instead of string concatenation within the query.